Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

This Red Hat security advisory addresses two vulnerabilities in PHP 8.2. The first (CVE-2026-17543) is a SQL injection vulnerability in the ext-pgsql extension caused by improper handling of backslash escaping. The second (CVE-2026-7260) is a denial of service vulnerability triggered by circular symbolic links in phar archives. Red Hat has rebased PHP to version 8.2.33 in the 8.10.z module stream to remediate these issues. The advisory covers Red Hat Enterprise Linux 8 across multiple architectures and variants.

Successful exploitation of CVE-2026-17543 could allow an attacker to perform SQL injection attacks via the ext-pgsql PHP extension, potentially compromising database integrity or confidentiality. CVE-2026-7260 could allow denial of service conditions by exploiting circular symbolic links in phar archives, potentially causing application or service disruption. The advisory rates the overall impact as Important (high severity).

Red Hat has provided an official fix by rebasing PHP to version 8.2.33 in the 8.10.z module stream. Users of affected Red Hat Enterprise Linux 8 versions should apply the update as detailed in the Red Hat advisory RHSA-2026:57574. No additional mitigation steps are indicated beyond applying the provided update.